This is Hacker Public Radio episode 4,081 from Monday the 25th of March 2024.
Today's show is entitled The Oh No News.
It is part of the series' privacy and security.
It is the 60th show, some guy on the internet, and is about 12 minutes long.
It carries a clean flag.
The summary is, Scoti gives us some moral panic written pearl clutching nonsense.
Hello and welcome to another episode of Hacker Public Radio, I'm your host, some guy on
the internet.
This is The Oh No News, let's get started.
Q-net warns of critical off bypass flow in its last devices.
All right, ladies and gentlemen, this article is coming from bleeping computers and the
beloved Q-net competitor to Synology, you know those little in-house Q-boxes, the beloved
NAS and a box.
Yeah, you know the ones.
What they've got a little bit of a vulnerability here is actually three vulnerabilities.
One of them, which is label CVE, 2024, 2189, is marked as low complexity and it can
be executed remotely.
So three vulnerabilities, in total, one can be executed remotely, the other two just sort
of play off of the first.
I'm not going to go into too much detail with it.
All you need to know is if you have a Q-net device and they have the models I listed in
the article here is the QTS models, the QTS 5.1 QTS 4.5 models as well as the Q-UTS
He-Roll and the Q-UTS Cloud models, I believe version 5 and 4.5 are the models that are
affected by this vulnerability.
However, there's a simple fix they've already patched it or you have to do is update.
The article also walks you through on how to update from the UI, you know, go to the
control panel, click on systems, firmware update, check for updates, your system should
pull down updates and you'll be good to go.
So if you are a loved one, are you using Q-Nap devices, just go ahead and perform an update.
Now the article does go on to tell us a little bit more about a few ransomware groups
that are currently targeting Q-Nap devices like deadbolt, checkmate, and Q-Locker.
But like anything that's on the internet, it is an attack surface so you're going to always
want to stay up to date.
Not only that, you're also going to want to back up your data.
Backing up your data is a sure-file solution to prevent ransomware attacks or actually
won't prevent ransomware attacks, but it'll allow you to recover from a ransomware attack.
See that story was just a nice little warm-up, it was a refreshing, cup of tea, in comparison
to the next story.
Switzerland, play ransomware elite 65,000 government documents.
Can you say yikes?
I know Switzerland likes to take that neutral stance, where right about now they're going
to have to be firing up a storm.
See, I had to go ahead and do some let-goals 65,000 government documents were leaked.
And it seemed like a lot of files were in Switzerland's Justice Department, so the current
agencies like the Federal Department of Justice, the State Secretary of Migration, Internal
IT Service Center, the Federal Department of Defense, Civil Protection, and Sport.
They even said that around 5,000 of the documents were just flat out personal information.
We're talking about names, email addresses, telephone numbers, and home addresses, along
with the good old technical details, like their classification information.
Oh, and let's forget about, let's definitely not forget about their account passwords,
we're all so part of that.
And I like the way how an article, they sort of shrink away like, you know, lean close
to the microphone and whisper, yeah, a small subset of the data that was leaked contains
software and architectural data, along with more passwords.
Yikes.
I can't imagine having to do the presentation for that one, right?
Can you imagine having to put together a PowerPoint and standard front of a bunch of guys
in the government and explain how this happened?
What, what you see, what happened was those guys over there did it, yeah, it's not my
department, it's the other guys that did it, if it could fire anybody fire them, I knew
I should have went to work at Google.
I said it'd be a little bit more clear, X-plane is a company that contracts to work with
this Wittseling government.
So if you want to split hairs, you can say it's not actually the government that was
breached, but the company that was contracted to perform these tasks for the government.
Nonetheless, the government employees and government data was still lost due to the attack.
What is this goes to show you, Switzerland should have hired me because I could have got
them breached for a quarter of the price they paid, X-plane, you understand?
And we would get a lot more jokes out of it as well.
And here's one of the things that I think is kind of funny.
They mentioned that analyzing the delete data, right, saying that this is legally complicated.
Let's stop and think about it.
It's already broadcasted on the internet for everyone to see how much more complicated could
get.
And you know, let's make sure only the appropriate containerized agency departments with only
the specialized individuals in their, in their perfectly positioned cubicles have accents
to this documentation that we found on the great wide open.
I don't see any information on how the attack was carried out.
You know, we don't know if this was like a sysadman hunt or a fishing type of attack or anything
with that information, it's just not present.
And I'm willing to bet it's because somebody used password 1, 2, 3.
I need to be clear, the article did not say that, but I wouldn't put it past them either,
right?
You got one individual somewhere in this investigation that had password 1, 2, 3.
Well, for the Swiss government or X-plane, you got my email, go ahead and contact me.
I can only promise you one thing that the next time you get breached, at least with me
on board, you'll have a much better time.
We'll throw a breached barbecue.
We'll do it almost like when it was gender reveal parties, except rather than revealing
the gender, we'll be revealing how we got breached, right?
And the name of the person who who's at ground zero during the attack, right, whoever was
targeted for the attack, put them on blast.
Can you imagine how hard it would be to get hired after something like that, so we probably
wouldn't do that.
That would be too mean.
You imagine putting, like, okay.
We have determined that the person responsible for the breached was D&T.
If you have any questions concerning the breached, contact D&T.
Ooh, that one was a toughie.
Maybe we should move to something a little bit lighter.
Let's move over to Dark Reader for just a moment.
Spoofed the Zoom, Google and Skype meetings spread corporate remote access trogents.
Now this story brings me back to a time when Microsoft mentioned in the past that they
were going to be making it possible for Android apps to run on Windows.
Does anybody remember that?
Now Windows, which is already just flooded with malware because they have the largest, they
have the largest user population.
The vast majority of the machines you buy out there today come pre-loaded with Windows.
So that's understandable.
I'm not faulting them for having malware when you have a large user population, obviously
you're going to have more tax.
But to think that it would be a good idea and allow Android applications knowing that Android
is just, at this point, Android is malware.
You know, it's so bad over an Android market and look, sorry, not sorry Android users out
there.
If you're using like F-droid or something like that, okay, kudos, I got you, right?
There's a sale-fish OS for those of you that can run it from understanding it didn't
run well here in the US, like no carrier, whatever, I'll let you get out on network with
it or whatever.
I could be mistaken, but that's just what I remember from the last time I heard something
about it.
What were another if you just run a stock Android from whatever vendor, LG, Samsung, whatever.
You gotta know you're dealing with a ton of malware, that you wrap that malware burrito.
You know what I mean?
You got malware, flatbread, called Windows, and you sprinkle in a whole bunch of malware
from Google.
It's terrible.
I'm going to give you a little bit of a spoiler alert here.
You should have just used Jitsi, all right?
But in any who, the attacker is basically using fake meetings, luring people in for these
rats.
And by rat, I mean, remote access, Trojan, and you know what?
Not even just Jitsi.
I mean, has anybody heard a next cloud recently?
I mean, you know what I mean?
There's so many better ways to do this, and a lot of these meetings, I'm pretty sure
could have just been an email, right?
Am I right?
Where you can get fished like a responsible adult.
Now I love the marketing in this article.
They have a nice little slogan here, click to compromise.
That's a good one.
If only Windows had a repository of software where you could go in the terminal and use
your package manager to pull down software that has been reviewed by, you know, knowing
Windows it'll probably most likely just be Microsoft employees, but, you know, if they
were going to do things in an open manner, you can get more eyes on not just the software
itself, but the code, but we're not going to go there.
Oh, wait, I forgot Microsoft Heart Selanix, that's right, I forgot about that.
I mean, they did open source to calculate it, right?
But what we do, we do have that fantastic new calculator, just just what we always wanted.
I include this article so that the next time you get invited to a terrible meeting at
work, share this article with your boss.
I don't know, look, I can't go to each of these meetings because it's too dangerous.
It's too dangerous.
I could, I could lose my credentials.
I could get remote access, Trojan, especially if you're forced to run Windows as well.
Oh, goodness.
And if you're still using Android, good heavens shut that thing down and get to some
F droid.
Or you can do like the rest of us who, you know, those of us that wear our top hats and
monocles walk with a cane, we are in our, in our, in our Tuxedos, we carry iPhones.
Yeah, we have, we have the blue bubble of sophistication.
Nevermind that it's almost impossible for us to do anything with the device and we own
nothing, not even the device itself, nevermind any of that.
We got the blue bubbles, okay?
Alrighty, ladies and gentlemen, that's all I got time for today.
I hope you guys enjoyed another episode of the Ono News.
If you have any questions about any of the pearl clutching panic ridden nonsense, we've
broadcast here today on Hacker Public Radio, please contact D&T.
You're welcome to leave a comment, I'll show it would be much appreciated.
And for those of you that are new to Hacker Public Radio, you can start by just introducing
yourself, letting us know who you are and what sort of hobbies you enjoy.
If you're worried about rather or not, we'd be interested in it, I mean, just look at what
I'm doing.
Clearly, it can't be too hard if I'm able to do it, right?
And don't worry about if people like it or not.
I've been doing this for a little while now, and I have not had one single complaint at all
never.
Oh, wink, wink.
So don't be shy, come on out here, give us a show, and I'll catch you guys in the next
episode of Hacker Public Radio.
Goodbye.
You have been listening to Hacker Public Radio at Hacker Public Radio.org.
Today's show was contributed by a HBR listening to like yourself, if you ever thought
of recording podcasts.
Click on our contributally to find out how easy it means.
Hosting Prage VR has been kindly provided by an onsthost.com, the Internet archive and our
single.net.
On this otherwise status, today's show is released on our Creative Commons, Attribution
4.0 International License.